docs: cut 1.0.37 changelog

[PeterGuy326]

Cut the 1.0.37 changelog. Two items in this release:

• npm channel realignment — the GitHub side of 1.0.36 was re-cut on 2026-06-11 with the canonical-tree poisoned-cache guard (fix(cli): guard canonical mcp tree against poisoned-cache flag collisions #454), but npm permanently forbids republishing a version number, so npm 1.0.36 stayed on the original unguarded cut (the release workflow's npm publish step failed with 403 cannot publish over the previously published versions). 1.0.37 is the first version where every channel — GitHub releases, dws upgrade, install scripts, npm — ships the same guarded build.
• PAT batch grant hardening (fix(pat): support batch agentCode and guarded grants #455): agentCode carried into batch plan/grant args, server-side default applied when absent, batch grants gated behind explicit --yes.

After merge: tag v1.0.37 on main → goreleaser publishes GitHub + npm. The npm publish step should succeed this time since 1.0.37 has never been published.